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#71 3^ tiKie^ #<$m. t= $m s^h tjm ^jl, ^ pus. 

5. 1 
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tHls.^» ^a)^ wH&1^ ^lfi 1 *^, H^lt ^^s. ^ & 

^- « w>6]e]^ {Curative Method for Computer Virus Infecting 

Memory, Recording Medium Comprising Program Readable by Computer, and The Device} 

S. 2^r ^SflS. <%<*o\] «H^^» *m/*]JL*Kr Ji^fe- 



31-4 



1020030023481 ^ ^ 2003/4/23 

^Ml ^^Hr ?H PflS.^# ^A]^ WHS)^« ^*M) AlS.^- 4^ 

<9> ^2)H ^A]?]^ *Hs^o| ^-rf. 

<10> ^ ^^.jl flfc ^^^al, 7l^^l(^-Cli 

ol «HS]^ 3*41*7 ^5L.m <fr?«R* flflig- = iM|^« ^(Kill) AlfJ 
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^hfr ^-Mfe ^SLhH #^*>fe H^fli BliBi^i «Hej^ofl #<*^l = 
¥3*1 ?1 fe 3*1 =szl^o1 w>o]e1^# 

<3€ ^^SL HH^^ofl ^ ^ ^l^o] 



-#7) ^Bfl 7l#o] *|qfe. «fl^*>7l ^*fl <&#^ 3*J<LS, 

^3 ^-a- T Safe <3*H tfl^- ^JiSAl, 

nflJiLSHl tf^fe ^^HM! 3^*Hfr $o] 7}^}JL, Pfl 
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<17> £ ygx$cH a rf= S.^ 6. p D A, ^J=$, te^, 7M AV<3-§- =ofl 

^ ^ *}--§-] 

<ig> ^ 

<19> WHs]^: A>-g-7>> #2fl 5^B) HSU^om ^^7>^ ^^*>JL, <*)7H 7>Aj 

<20> wH^^ofl ^ <$q : ^3 o. s - w>ole^ 7 > ^ ^ 

tcp/i p n% s.^, Jfm i-oi <^ 7 H s^cf. 

^ -gr^^l^: A>^## 3L^^.S. ^5) ^ £<gf-jL3.Ml, A^H7fl ^ 

^^■i- *fl^fl ^fc 7}^?>6|1 ^SlH^ ^^g. ^t$^ =c S ZL^ ^Plttq-. 
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7> afl^Hr f-^rSAi , -g-g-^n^ Jifl o] ^(API ) , s#(system call) 



<23> =5.4^: §Vi4^ H5.ZL^ ^ ^# ^M^K 

<25> ^"71 ^-^^r ^«>7l 4)41, X) Wgofl ^ 

<26> (1) wHel^oj) ^ &i=. ^ofl tfltV ^iL# ^^^71 ^Sfl A>-§-^- ^# 



<28> ^ 2^ ^ *l] 3#^^1 4^ ^-7] ^-^1 (2)ofl ^ ^ *l^.tfl#o.3. 

£.5^ <3^o] c) ^7>^ «H*^3 *lSL^* *H*$th 

<29> ^. 

<ao> (i) Bfole)^ #<g^ ^ &i=. «^^oJ| tflt!: 3^*>7) *>-§-^: 
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W ^Afl«l -I^al*} ^t\r. -g- 71^ ^ £ o.^ofl^> ^£)*1 

olrf. ^S-Sl(l)^ SSAfli 5j^H(2) £ o]«q. ^s]^ 2^|a ^(3)* a^rj-. 
*f2. 4fe 71 «?#*|* t+^cf. 

^^-« (a). ^ HS^i B7> ^ ^£5. ^€ *fl# 

^(kill) Al^lt)-. ojnfl H>^§>7flfe ^Sfl SM^t ^*]7l7l 

4 (c). ^71 ^ofl o}*fl pJ)a.^oll^ H>olBl^7> *lj§L^ B7> ^^tj- (d) . 
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API (Application Program Interface) *K4£ °l-g-^ri=r. 

^4! SSn^ol Plej API w>omsl isjE. 

Sr #<3€ ^ 5^ <8«H tfltb ^^.« ^^*>7l ^)«fl a>-§.^- API w> 

*>fe API <ms. cf^-sf ^#o) ojrf. 

<39> NTDLL.DLL: :NtQuerySysteminformation 
<40> NTDLL.DLL: :NtResumeThread 
<4i> NTDLL.DLL: :LdrGetDIIHandle 

KERNEL32.DLL: :FindFirstFileExW 
<«> KERNEL32.DLL: :FindNextFileff 

ADVAPI32.DLL: :Enum ServicesStatusA 
<*5> ADVAPI32.DLL: :Enum ServicesStatusW 
««> ADVAPI32.DLL: :RegEnumKeyExW 
<47> ADVAPI32.DLL: :RegEnumKeyW 
<«> IPHLPAPI.DLL: :GetTcpTableFromStack 
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<49> IPHLPAPI.DLL: :GetUdpTableFromStack 

<»» WinXPofl ^*fl*H=- NTOLL.DLL: :NtQuerySysteniinformation ^7> wMe^ofl #<£s] 

<51> 

B8«AC 00 00 00> mov eax^ch E9{BC 13 FD FP) imp 0FFFD1371 

BA 00 03 FE 7F mov edx.7PFE0300h — ► BA 00 03 FE 7F mov edx,7FFE0300h 

FF D2 call edx FF D2 call edx 

C2 10 00 rem lOh C2 10 00 reta 10h 

<52> ^"71 5f £o] API S = 7 > ^^5)^, API ^^<LsL ^S\7) ^ 

«H^^7> ^ -a««tj.. »Ha|^ API *H!°1 <3<w tfltb ^ji 

7> #5=^ n>^-cf. n}^, API -%^7\ ^ffc=. 7^]jL^ «H3^ 

^ ^^tb ^*fl 3# API S = # PlE) ^A] j£ fe 7 ] 

tfl^V ^^*>7l ^«fl>H A>-§-^ API ^» P]E) ^Sfl *gr± 2=4 

<54> HU3^d|^ pflS-^ofl tiMe^oJ <|^»q-T<ol ^ 
7>^}t}. 
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<55> 2£f *]ZL& 34. API ^7} ^-f^ API $^3. 3^3: *1|S- 

ul7> ^ ^-f ^ -id^SH ^^S. ^^-t- ^t}. 

<56> SEt!: 34, API a*=7> ^SlSt^ tiHejAofl #<*^ a 

3 Iv^^-JELS., API ^Hr# p]t£| T^Sfl 3££ 4^ 



o]^- ^ API 7>^l7fl €4. ^7] S^^fe H]- 0 1^ 

^ofl #<g^ ^ o§*H tfl^ ^^^>7l ^Sfl^ W$ ^ API ^ 5L 

^» xilel ^Sfl ¥5**1 nflS-BH -JH^fe »3>|£*hfr 3^*Kr API 
*i^*fl *r5. 5£4. 

«H&li ^12-^^ = #<$X\7)m #^171*1 & 

^i, API ol-g-^H *1|S.eH Bl^H^- =3.^ 

a^lm(Entry Point; EP)«- §Hr4. «H ^>-§-^}^ API f-^S.^ 
NTDLL.DLL: :NtQuerySysteminformat ion <>li4, NTDLL.DLL: :LdrGetD I IHandle <>1 
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<eo ^s.h! *M*H>*1 =3.^3 ^ S.^1H(EP)^ «Me]^ofl # 

n||.E.sH #^*Hr H^lif 2Umt}-. pfl2.e)ofl A, B, C =5.>Hl^ 

7} ^^-JL B H£^]i7l- ^Hsl^l *13L7> 1:7>^ *>^, pfls.e)ofl 

B HS^flif m^m^.CS. 1 

<62> ^S-ejofl B 7} B ISAjAf H*]7]&tfc pflA]^ 

°1-B-^ A V-§-^>7} ol^l ^ ^o] B HS.4^7> tfj^l SSZL^^l ^3 -°3. ^.S. 

3<H ^ ^91 A>^m «<WKxL, A>-g.^> 7 > #7l ^A^l» ^.Jl Sfjig- 

^ *r 5£*r ^71 3H^. 

<63> A\-$rX}7} ^o\ B =S>H]^b *1]5-£HH ^^e)^t)-. 

<64> ZLt$JL 71^^1(0^15-, ^=1=1^3)^^^ 5.^1^1 «fi^>fe S. 

1* ^1* B ES^lii Sfl^Hf- 4°^* 7l<3#*loJM 

<66> 7l^^HA-l S^l^ofl Sfl^Kr ^*fl*Rr ^g-f , 
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£<gSM|7l- ^%*>7fl ^Wfe «b ^ &7] 141^14. 

^SLBHfe- SS^i ^^Hz- ^7flS. <8^o] ^ ^Tfl-^rf. ^efliEE. 

* w>ol5li#(ofl# Elkern tfl^ ^efl^ 

^7>^ ^3lJEL» ^Aj^l^ A>-g-A>7> A}-g- ^o] 
^0>0> ^-4. O^HA^E. ^-7HA^ P^Ml API 
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NTDLL.DLL: :NtResumeHiread)# °]-§-SH ^t^lS. ej^H^f ^ ^5)]^.o| A ^ ^ro] 

£^r*l« ^#^4 wH^^ofl #<$q = Jf^)) 7 > 

£ 3-gr *f| l^ofl 4= ^-E^t}. 
3*1 ^3*1 API bM^e] 7l^#*l(aj]« # 

^l, ^3= ^3)4] n]Hl #31 301<>M*r #71 API ^Sj- 

#<3€ ^ 5Ufe- tt\i& $^ 7 ) A>-g-^- api wH*-13 

2£ « ^ *lS«t).. ^741 302<>*M ss.7). ^<^ W jl ^^-ofl^ ^ 3045. ^ 

<H7M HS^iS] W>o]a]^ 2l#^JL, %<LrL Jfr^ ^-fofl 

^ API ^# *H 4^71^1 (^7^1 303), 3045. #<^^-rf. 

#31 304^1^ *f|S.eH Aj-^-Kr £S^i7} hHs]^ #^£]&tt*1^ <*) 
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*L#*}-aI, #31 305<*IH = 5.^7} #o.3. ^-f #3) 306 

^lS7>^^«.^. ^^cf. ^ 306^1 >H ^1^.7>^^c}-ul ^-Mfe- #31 311 

*fl# SlS-Ska, #31 308<>JM *fl# 7]^^liA] 3^^. *1 

S-7}- l-7>^*>rfzL ##3 ^-foflfe #31 307<M *B# ESAflAf 23*1?} ^, #3| 308 
7l^#*HH ^^M}. #<£ #31 309oiH Sfl# ^IH 7l^^H 

^*fl*Kr ^ #31 310*1H *fl# sHI# ## ^ o]» ^^Al^ltf. 

MM-. 

^71 3j-^ofl API «^ il^^M- ^ *flS3|« 

3E 4^ 31 2^#*fl 4^2)^ -8*1 ^^rf. >g-7l 3j->§^. £ 3 

s ^ SE^/^ s^fi} :*!# ^ *1 3.43*1 ^s^V ^ofl 412) 

•^Hs}- ^-01^. ^] 504«^a^ Pfls.e|^ d^E. ## ^ ^st!: ^hfr, # 

31 505^1 ^ ^fiElofl ^*}^ HS^li7> wVolsl^ofl ^^^)^\ c^JfL^. ^^al, 
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^-•S- ^lS^-JL, #7fl 509^1^ Sflig. 4-^^. 7]^^H>H ^^^-Cf. ^S7> l-7>^cf 
JL ^-f ofl^ #741 508*0*1 *fl# ^Al^l t£j$ 5094M Sflxg- 2j-<g 

* 7l3#*HH ^ #3] 510^ sj]^ 7l^^H #7fl^ 7%°- 

<M Sj)# s^o] 7]^#*H ^fl^l ^ Jflr^^ 3^ «>S ^Stb^. 
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<81> ZLfilM-, £ ^Bfl^ o]6{) ifr^x) PC Uj- PDA, ^S.^, 



^ wHHsl as* Pis) ^J-^s]^ Sfrfr API ^-=r^ w>o]u)sj 5I3=<4 

wlJE-sH, API f-^r^ w>o]uie) 2 = » H}.olu|2] 2 £S. ^^-cf. 

°1 ^, «H*^ API *M^sl *)#^- ^ 

7l^^]# S.^- ^ #0.^, API f-^r^ wH^s) *\)*§.S, ^^-s) 

m o].g.^ *1 

3" S.°iS(Entry Point; EP)-fr ffet}. n^Jl, ti|£2] sflol*^^ sfl# n^^o} ^ 

^tb ^7>^S ^^l7l^Cffe PflA]^l- A]~g-7,H»1 t^^o] 
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tj-. ^= *]£L^#£- API °]-g-*M *flS.BH ^Sful Z^ofl 

^2. fljl, HSAfli ^s^o] API tf«r# ol-g-^H ^JSLBH <$^is}^ £ 

^ofl «Hs1^°fl ^ <3^H tfl^- J}«| 

*I)S.t!H #^*Hf BB>^^o] ^^>7fl ^^Kf- ^o] 7>^>jl, Pfls. 
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1] 

(1) wH^^ofl #<g^ ^ <8*H tfl«- ^^^71 3*fl A>-g--Q- ^# 

(2) ^J'SKl o]-g-*H ^flS.^ HS.^ ^ *fl# tfl^S. 

[3^* 2] 

*fi rM sa^H. ^i (2)^ >8^*i 

3] 

*ll 11H $a°W. #31 (2)*r 
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[^t 1 * 4] 

5] 

fflS-BHl -SHWfe =3>fl>i* *h2*Hr #7fl; 
[3^% 6] 

#7] £S^|it *!3:*H *lS7> 7>^m ^IS^jI, ^]fi7} l-7>^^ ^-71 H. 

» 
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7] 

°fi?m*l, OS/2, -fi-Hdii, Bl^ofH *H^§# 

WW 8] 

^fe- -g-g-HSZI^ 5fl o] ^(API ) ^ ^ « <y ^o_s. 15Hr 

91 

10] 

*l 9ti sa^H, #7j] (2)^1 ^^-^1 

^7> ^4- ^ ^a^, ^-fofl^ p]Bj *| 

111 

*fl 9^*fl 5U<^, ^1 (2)*r 
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3J^r ^ 71^-nfl^ 
[3^8" 12] 

S. 7)^*\) 

13] 

*11 12^1 $X°]x), &n (2)fe 
14] 

*ll 12 ^ $a<>H, (2)fe 
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Wtt 15] 

f-^rfe- -§--§-= SZL^oiB] 511 oI^(api) SEfe Al^Bg oj^. s.^ o.s *>fe 7] 
16] 

€ °1« ^-€*>7l 

f-^r» °l-8-*M ej^B^ is^fli zj-zj-jq a]^- i°jBt ^ji, 

^ *|s.*l-fe ^-i: ^^^-fe & 

WW 17] 

*H 16*^ 
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[3^* 18] 

*0 16*4) 

^Hr JEi, OS/2, ^i, S^d^A] ^o.S. 

19] 

l^^-Q 20] 

*fl 16*4] ^<H^, 

#7] «}©le^ ^s^ife. pc, PDA, 3E**Hr <*fl 3 
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Mmm API @4>£! UfOILIBI 2E SAJ 
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IS. 6] 

1 wwi^n^n 
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